TryHackMe Hacker Holidays 2026 — Packed Light Writeup

Written By Aryan Giri

Room: Packed Light
Category: Forensics
Difficulty: Easy
Room URL: https://tryhackme.com/room/hh-packedlight-02e5330c

Scenario

The hotel network appears normal at first glance, but something unusual is happening.

A host repeatedly communicates with a service running on TCP port 8080 every second. The traffic is small, consistent, and looks harmless until inspected more closely. Our objective is to identify the covert communication channel, recover the hidden data, decode it, and obtain the flag.

Download the Challenge Files

Download the ZIP archive provided by the room and extract it.

unzip PackedLight.zip

Inside the archive you'll find the packet capture (traffic.pcapng).

Open it in Wireshark.

Inspecting the Traffic

Before diving into individual packets, it is worth observing the overall traffic pattern.

The capture shows repeated HTTP requests to a service running on TCP port 8080. More importantly, these requests occur at nearly one-second intervals, which is characteristic of automated beaconing rather than normal user browsing. This regular communication makes the host an excellent candidate for further investigation.

Although filtering with:

tcp.port == 8080

works, using the HTTP dissector makes the analysis much cleaner:

http

Almost immediately an interesting request appears:

GET /temp/updates.py

Recovering the Python Script

Right-click the request and select:

Follow
    → HTTP Stream

Following the HTTP stream reconstructs the complete client/server conversation, allowing us to inspect files transferred over the connection without manually reassembling packets.

This reveals the Python script being downloaded by the client.

Reading the script reveals the covert communication mechanism.

The downloaded Python script prepares the data before placing it into the HTTP cookie by:

1. XORing the plaintext
2. Encoding the XOR output using Base64
3. Storing the result inside the hotel_sess_state cookie

The important takeaway is that the cookie values are not random—they are encoded pieces of the exfiltrated message.

Finding the Hidden Data

Now filter the HTTP requests containing the suspicious cookie.

http.cookie contains "hotel_sess_state"

Each HTTP request now contains a value similar to:

hotel_sess_state=HA==

Instead of carrying a normal session identifier, the cookie changes with every request and contains short Base64-looking values such as HA==. This unusual behaviour suggests the cookie is being used as a covert storage channel rather than legitimate session management.

Each cookie contains a tiny fragment of the hidden message.

Decoding the Cookie

To understand the encoding, open CyberChef:

https://gchq.github.io/CyberChef

Create the following recipe:

From Base64

XOR

The Python script first XORs each byte before Base64 encoding it, so the decoding process simply reverses those operations:

1. Decode from Base64
2. XOR with the recovered key (H)

During analysis of the recovered Python script, the XOR key was identified as a string beginning with H. Only the first character (H, ASCII 0x48) is applied to the one-byte payload stored in each cookie, so using H as the CyberChef XOR key successfully reproduces the original plaintext.

For the first cookie:

HA==

CyberChef outputs:

T

This confirms that every cookie stores a single encoded character.

Recovering the Entire Message

Copying every cookie manually would be slow and error-prone.

Instead, use tshark, Wireshark's command-line version.

tshark -r traffic.pcapng -Y 'http.cookie contains "hotel_sess_state="' -T fields -e http.cookie | sed -n 's/.*hotel_sess_state=\([^;[:space:]]*\).*/\1/p' | tr -d '[:space:]'

This command:

• Filters packets containing the hotel_sess_state cookie.
• Extracts only the Cookie header.
• Removes everything except the cookie value.
• Concatenates every Base64-encoded one-byte chunk into a single continuous sequence.

Example output:

HA==AA==BQ==Mw==Hg==...

Decode the Complete Payload

Copy the output from the tshark command into CyberChef.

Use the same recipe:

From Base64

XOR (UTF-8 Key: H)

CyberChef decodes each Base64-encoded byte, XORs it with the recovered key (H / 0x48), and reconstructs the original plaintext, revealing the room flag.

What This Room Teaches

Packed Light demonstrates a simple but effective covert data exfiltration technique.

Rather than sending the secret directly, the downloaded Python script:

• XOR-encodes the data
• Base64-encodes the result
• Stores each encoded byte inside an HTTP cookie
• Exfiltrates the data one small chunk at a time through regular HTTP requests

Although each request appears completely legitimate in isolation, examining the application-layer data reveals the hidden communication channel.

This room is an excellent introduction to:

• PCAP analysis with Wireshark
• Identifying automated beaconing
• HTTP stream inspection
• Recognizing covert communication channels
• Extracting hidden data from HTTP cookies
• Reversing simple encoding schemes with CyberChef
• Automating forensic analysis using tshark

While the exfiltration mechanism is technically simple, it demonstrates a common covert channel technique: hiding data inside otherwise legitimate application-layer traffic. Because each request appears normal on its own, identifying the beaconing pattern and inspecting HTTP headers become essential skills during network forensic investigations.